Mixminion threat model

Global passive adversary -- observes everything

Runs some of the nodes

Can inject, modify, delete some traffic




Weak attackers are stopped;
Strong attackers are only delayed.